OpenSSF Supply Chain Integrity WG, 6 Jun 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Supply Chain Integrity WG (June 6 2023)

Description

Agenda: https://docs.google.com/document/d/1xPs2sSbH3I9Ich7OyLOzl85oJshnK8Q6WoAgREE5-zA/edit

A

It's Ever Enough.

A

Bruno Mars I'm actually triple book today, so I'm uh I'll, probably be a be be a little a little behind the meeting today, if if, in fact we're still having it because here we are three after and it's just you and I.

B

Hope sorry I was setting up my audio I didn't hear you.

A

But I said I'm gonna be so I'm actually triple booked uh right now there goes Melba and right now it's just us three. So hopefully we're even still having a meeting today, but I got two other meetings that are uh that are a must, join so I, so I'm.

A

Hanging in the background, a little bit: okay,.

C

Folks, yeah, sorry for being M.I.A, um it's been quite the roller coaster and I'm not out of it. Yet. Yes, um my sick, my kids are sick at home today and they were sick the previous week and it it yeah. It hasn't been a fun fun month, to say the least.

B

D

B

D

C

Let me see yeah if it's just us and I think that'll be fine. I might take the time to to catch up.

D

C

Going to open up the notes.

B

Yeah last meeting uh it was um me Jay and Mike uh Liberty I think I I can't remember exactly, but we decided to cancel because people were not able to attend.

C

It's after a holiday, so I'm not surprised.

B

D

Yeah, uh so let me okay.

C

So I found the notes.

D

C

And if you hear birds chirping in the background, I have my doors open, so apologize, um it's kind of nice outside right now, yeah.

B

It's a nice sound as well.

C

C

No I'm gonna guess Mikey is not Mike Lieberman.

C

Okay, yeah, that's fine um I just wanted to make sure nothing uh changed. uh Since I last was in this meeting.

D

C

Mike adopted a new nickname.

D

Okay, uh let's see.

C

D

Hi, okay, so let's so first.

C

um I wish I'd like to do the welcome newcomer, so Mikey I, don't know if you've been in this meeting. I've been absent for about a month, um so not sure if you're new to the team- um and if you are, if you can introduce yourself, then explain what brought you here.

E

It's um relatively new I did drop in at least twice with this group, and basically I am a developer and a supply sharing kind of company that have been popping up all over I'm trying to like understand what is going on in open ssf. Who is doing what and trying to find like where we can fill in where we can blend the hand with our interests aligned. Basically.

C

Okay and I noticed on the chat. You said that there is a I'm looking for the calendar.

E

Last week, what happened is that we Jay wanted to I think go to the other meeting and it was like only like to people, so we decided to cancel and just merge into the other meeting.

D

C

Is this is a problem, because this wasn't a conflict before um Sterling tool chain was was not on the calendar at all. So now it seems like it's conflicting with this meeting and is it every week.

D

It is every week.

C

So it started last week, six yeah so because it started last week now we're going to have to figure out if we need to change this meeting, um because it does conflict so appreciate you mentioning that um Mikey, um okay, so you've been trying to get my formatting right. Okay, so.

D

Don't change meeting is yeah.

D

I'm going to I don't know.

D

C

New day time, okay, so that's going to be a fun exercise, because we already did that once recently and a lot of people could make this time um so now with that meeting, it.

D

C

It complicates things a little bit um are there and Mike I. Think sorry, I keep I, keep calling you Mike. Sorry I apologize trying to get this in order. um Anything else on the agenda. I know mine is last week, I, don't see, May 23rd I, don't see any um any notes, uh so I'm not sure what was what's been going on in the the last couple weeks since I've been gone.

A

We we canceled uh I, think we canceled the last meeting um because it was just um us on the last meeting because of the um I want to say it because of the Sterling two chain meeting, or it was something else, but it was just us the last meeting, so we so we canceled it yeah.

C

Okay and what about the 23rd, which is the week before.

A

Say the 23rd was the last meeting yeah.

D

I think I think um yeah.

C

A

Was two weeks ago.

C

Well, we have this meeting every week. Oh.

D

B

We yeah, we didn't put anything on the on the on the on the minutes. Notes. That's right!.

A

Yeah we Jesus did we just completely yeah.

B

A

All together, like you, miss putting something in the notes. Oh God,.

D

B

Always check in here and say: well, if I remember correctly, the last mission was not four people. It was less than this. It was me Jay and I. Think someone else yeah.

A

It was three people in the last meeting. It was like 30, which was just three of us yeah.

C

Yeah, the 30th was the last meeting and then I can say this was canceled right, yeah and solved right.

A

um But the 23rd part of the problem is that a lot of these meetings that will have I mean there's so much going on at the same time. Now this is not the Sterling 2 Chainz, not the only one, the AI Mel one is the one that I think got caught up in the madness. uh The last time that was held on a Tuesday too.

C

Interesting yeah yeah.

A

No one happened and then um and and then, if you let's see uh how I want to say that was the culprit, uh that was a culprit. The last time.

D

A

D

Okay, so to stay: Sterling, Supply, Sterling, Supply, no.

A

It was a stolen 2 Chain, the last one.

D

A

I have no one, that's Brian, oh, that was all that was on a Wednesday, never mind that one happened.

C

Number one: oh, that was a supply chain, Integrity group, then.

A

There's only two chain: one is the one that uh the one that sprang up on us. Okay,.

C

A

C

A

Yeah I'm not sure what happened on the 23rd then well 23rd. You saw that with just a few of us.

C

Yeah, okay, um so for for today's session and then um I know there were a couple things we were working on um before there was the framing based off personas May 16th, so that was after the conference um there's threat scenarios that we were talking about.

C

I started doing this um uh and I haven't been back to doing it since basically setting up the sci working group, repo for our blogs and for the charter Etc, um so I don't know if there's been any update, Jay on the one pager.

C

Did I lose you Jay, oh.

A

E

A

Here: I'm sorry, I I, as I said I'm in I'm in a three different meet. What was that again.

C

uh Has there been any progress on the the one pager or communicating blogs.

A

Oh no look, there's progress, I started it I, still, I still I still I still got to put more put more work into that and I will so. So that's that's. uh That's coming uh give me one second sure.

C

Okay so I don't know: I'm gonna go back at the one pager.

D

C

Okay and then uh Claudia welcome, um hey Mommy, yeah I, know you've you've been in um before, and that this was a a future agenda idea. It's been out here for a while I feel like you would have done this by now, um uh but I I think it's probably best at to to close that one out I'm like wait. A minute I see you on the agenda. Why, like? Oh okay, um thanks for joining yep, um trying to think okay, so then uh um does any?

C

Has anybody been again I've been out for a while? So from a salsa perspective, um has there been any progress on some of the the pers, the improvements on Communications for framing the personas or other issues and issues other concerns that the community had um in terms of you know needing more examples? Etc does anybody know if there's been any movement on that.

D

F

Nothing on my end, I see um those are my comments there, but I haven't had a chance to dive into any of that. Okay, I'm.

C

Wondering any yeah, because I know there was a lot of um a lot of comments from the conference that were discussed. So I wasn't sure if there was any movement from the salsa team um in.

F

C

Some of those concerns.

F

We had a um very Lively conversation, I, don't know. Maybe it was the 23rd of May where we talked about um I can't remember if I was sad, I can't remember if I was there, but.

D

C

F

Was oh uh or Jay and I were talking uh and Mike um we're talking about um playbooks and um changing kind of reframing the how we categorize uh salsa.

D

C

Oh in terms of like a security framework versus a policy versus is.

F

That what you mean yeah.

C

Okay um and I'm, guessing you don't have any notes on that anywhere.

C

um I'll have to look at the previous recording then um to try to figure out what that, what that meant um any updates on blogs. I know there was a Blog that I was working on with Chris uh from Google um and obviously with the craziness I'm, not not done that. um So any any updates on that. In terms of like the blog work I'm trying to scroll down to where we had to list there we go.

C

uh This was the in progress. One.

C

I think you were gonna share, something I think the new mapping is that right or open ssf.

F

Yeah I shared it in slack um just before the um Vancouver trip and uh Chris Coy also highlighted and shared it out during um his presentation. Okay,.

C

F

um But but there's auth I saw that there's a almost like a deep dive into that that somebody posted recently um in slack where they took that to the next level. I forgot. What her name is um mine was just a like a Consolidated mapping where you could literally it's a more of a visual. You can see where it'll like wear salsa.

F

um It aligns and overlaps across the different industry standards, but this was more of a paper.

F

It was like a deep dive into it. I now have to find it again. um It was in recent slack Channel. Maybe in this I'll, find it I'll post it in here as soon as I find it. Okay.

C

Thank you, yeah and I know that there was a Blog for for those um that weren't aware open, ssf SCI the eye chain. There was a Blog recently.

C

On the supply chain, Integrity working group- where is it maybe it's here- vlogs yep here it is um I- know Isaac did the the majority of the the work um for for the initial write-up and.

D

C

There were some some comments back and forth here and there, um but just I wanted to highlight that one, because, as we remember, we are the supply chain, Integrity group positioning now I keep forgetting that right.

C

We're not just salsa anymore, um so anything we can do to recruit or get the word out about what our overall mission is outside of not outside of just salsa um that that's going to help a ton um and I know one of the things that um I definitely want to dive deep into next is s2c2f I know, I gave I, did a one-on-one with Jay um and giving feedback on some of the things that I read while I was looking through s2c2f for the conference, um and my intent is to try to raise issues or requests to address some of those concerns.

C

um So that's one thing and then Fresca is a whole nother, um ballpark I know we asked for help refresh from four Fresca here, um so I'm not sure how much feedback we've gotten and how much um I guess help we've gotten since the release of this I guess it's only been like what a week since this was released. May 31st yeah, it's been been almost a week, um so hopefully that will bring new people um and then there's the new supply chain, integrity.

C

uh Github here it is right, um so we're trying to revamp this as much as possible. um I think I have a pull request, yeah that needs to get to to add extra stuff.

C

um So if folks are interested in partaking and helping out any way she performed, please please feel free to open up an issue um or or help out wherever it is where your skills fit.

C

So that way we can kind of get the supply chain, Integrity group, Mission kind of rolling um and because the governance updates haven't um been included. Yet this was the charter that Isaac had started and then, as a group on the Wednesday calls, we went through.

C

Obviously the format looks a little different, but it's that Google doc that we had gone through as a group on the priorities Etc. So for no those that are new to the group. This is a good kind of foundation and here's a sterling tool chain concept which we'll have to uh kind of dive deeper into at some point. But for now I think salsa is in a good place.

C

We just need to keep do the maintaining and and iteration on, salsa and I think it would be good for us to start diving into s2c2f, because a lot of people are asking.

C

You know the difference between Salsa and S2 c2f, then y1 versus the other, and given that it's been not quite a year like J right I, think it's been almost a year, maybe in october-ish that stc2f was donated to openss and it's still on version one, and so it would be really good to get s2c2f.

D

C

To the next version, um so thoughts comments on that.

A

Yeah I invoked, you I invoked your name now, but in our last meeting because of all the great work you did um I know, you've been uh I, know you've been going through it, but goodness I was I was trying to find for the life of me. I couldn't find it I thought you might have posted it, but the but the the thing you, the the red, the red.

C

Oh, the PDF.

A

The red pen, with the Stars and everything that was fantastic. How you like, went up down left right and center of a of the spec.

C

um I, don't know if I ever gave it to you, I might not have um I might have forgotten, um but my my plan, I, don't know if you have a meeting today, um but I was hoping to do some of that today.

A

You can, please all means, jump on it and come and join because I thought that was fantastic, um that that's the kind of energy we need and- and you know the way that you went about it, I I was trying to describe it and I just couldn't describe it well,.

C

It's called redlining.

C

uh So yeah um I think that that's a good next step right, because one of the things that we as a supply chain Integrity group need to work on is what that overall vision is and how things are mapped and I know there was I'm looking for it. There was a picture by David, wheeler I. Think or is it um I thought I had it in here somewhere, uh where it shows this thing right.

C

It shows kind of how everything plays together, but it it doesn't necessarily zoom in to the supply chain, Integrity working group and what we're all about right, and so we really do need to kind of zoom in how the requirements um either fill in each other each other's gaps.

C

um Or you know if we do find a gap and I think between the conversation between Jay and I, we did find a gap. I can't remember what it was. I'm sure I have notes somewhere, um but we did find a gap and we say: okay, that's something to think about, um but we need to go through that exercise so that we can share that Vision with the broader community and make salsa and s2c2f and hopefully Fresca.

C

um You know better for for the community.

D

Thoughts questions concerns.

C

Oh thanks, Laura, okay! uh Next, are there any other proposals.

D

C

F

Ahead I was just saying: you're welcome. uh Hopefully you can access. Those I've got a pdf version, that's in slack, but wouldn't let me drop it here.

C

Oh interesting, okay, um yeah, that's I, wonder if you have to do like an insert, attach or insert something nah. It's not quite like word, um okay, so.

D

D

C

C

Versus I, don't want to call it a gap, analysis but I think you, you understand the uh the intent um J versus salsa versus Fresca, um any other thoughts on where we might want to go next. I know: there's still some blogs in play, um thoughts, questions or thoughts or or maybe, suggestions on. What do you think we? We should do next.

A

Well, so David wheeler have put up a um issue a while ago about us doing this crosswalk. So I think it's about time that we do that I! Think.

C

I think this is a perfect time for us to do that.

C

Okay, working group um people, you know I know that this was started right, um but we haven't finished it, um and this would also started then pause and then start it again and then pause um so I apologize for that uh anything else that we can think of.

C

You know there are any conferences that we might need to consider um prepping for trying to find individuals to fend.

C

And I know: there's you know black hat and Defcon, and things like that, but I think those those are um the RFP uh are long gone. The deadlines, if I'm not mistaken, so I'm, not sure if there's anything else that people are aware of.

D

C

Okay and one last question, because I don't want to keep people since it seems like uh people are shy today, uh one last question: um when it comes to education sessions right, we do a lot with blogs, um but I I personally take a while um to absorb written material and so I do better with audio or or visual.

C

So what are the team's thoughts on doing some of the 101s or intermediate? You know deep Dives in a video form for people, and then we can post it on our website.

C

101, no, no okay, I'll put it on the on the agenda. Tutorials.

C

Okay, well, uh since we have a quiet bunch and and not a whole lot on the agenda, um we can go ahead and cancel the rest of the meeting or you know adjourn the rest of the meeting uh and I will have to send out a poll for rescheduling this meeting to another time. Now that the Sterling tool chain is is conflicting and do you know Jay or or um uh oh, my Mikey dropped? uh Do you know who owns that meeting or Sterling tool chain.

A

Yeah, oh I, believe uh Crow bones. It.

C

D

A

Yeah I mean I'm. That is one of that's one of the meetings I'm in right now, I'm also in a I'm in that meeting as well and I'm, also in another meeting as well, so that that is one of I'm doing both okay.

D

um Just because you.

A

Know interests are in alignment here and that I have to be in my ear here, but also here as well. So so.

C

A

Triple time on these.

C

Music, okay, okay, okay, well, I'll, see about you know getting out a new survey, um so we can change this meeting. I might ping probe to say Hey! You couldn't find another time, uh give him a a a. You know a hard time on the on the calendar. Invite um but uh yeah I'll see what I can do.

C

Okay! Well, thanks folks for joining um and uh hoping we, uh we get some speed momentum here now that we've come back from holidays, Etc and hoping that we don't have more conflicts going forward thanks. Everyone talk to you soon, bye.

F